# WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.2.10 - Authenticated (Contributor+) Insecure Direct Object Reference to WooCommerce Customer Phone Number Disclosure via 'post' and 'id' Parameters

- **ID:** WPSEC-2026-2241
- **Plugin:** WSMS (formerly WP SMS): SMS Notifications, OTP Login and WooCommerce SMS (`wp-sms`), https://wordpress.org/plugins/wp-sms/
- **Affected versions:** all versions before 7.2.11
- **Fixed in:** 7.2.11 (Update to 7.2.11 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-sms
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2241/

## Description

The WSMS (formerly WP SMS) plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'post' and 'id' URL parameters in all versions up to, and including, 7.2.10. This is due to the admin script enqueue routine, which runs on every wp-admin page, taking a WooCommerce order ID from those parameters, looking up that order's customer phone number and printing it into the page's JavaScript without checking that the user can edit the order. This makes it possible for authenticated attackers with contributor-level access and above to read the phone number of any WooCommerce customer by changing the order ID in the URL of any admin page they can load.

## References

- https://wpsec.com/vuln/WPSEC-2026-2241/
- https://plugins.svn.wordpress.org/wp-sms/tags/7.2.11/
- https://wordpress.org/plugins/wp-sms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2241/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.